Ensure the cached rq pointer is still valid before waking up the address, the

zyd_cmd function may have timed out. It wouldnt cause a panic but could wakeup
someone.

Spotted by:	HPS
This commit is contained in:
Andrew Thompson 2009-03-06 17:04:47 +00:00
parent 125dcf8c7d
commit d953f72075

View File

@ -796,10 +796,14 @@ zyd_intr_write_callback(struct usb2_xfer *xfer)
switch (USB_GET_STATE(xfer)) {
case USB_ST_TRANSFERRED:
rqp = xfer->priv_fifo;
DPRINTF(sc, ZYD_DEBUG_CMD, "command %p transferred\n", rqp);
if ((rqp->flags & ZYD_CMD_FLAG_READ) == 0)
wakeup(rqp); /* wakeup caller */
DPRINTF(sc, ZYD_DEBUG_CMD, "command %p transferred\n",
xfer->priv_fifo);
STAILQ_FOREACH(rqp, &sc->sc_rqh, rq) {
/* Ensure the cached rq pointer is still valid */
if (rqp == xfer->priv_fifo &&
(rqp->flags & ZYD_CMD_FLAG_READ) == 0)
wakeup(rqp); /* wakeup caller */
}
/* FALLTHROUGH */
case USB_ST_SETUP: